Read the install snippet

The site's public key. It appears in every visitor's HTML, so it is public by construction -- put it in a client-side environment variable, not a secret store.

One of EU, US

The exact bytes to place in <head>. ORDER IS THE WHOLE CONTRACT: this goes ABOVE the tag manager snippet and below nothing except whatever sets the visitor's jurisdiction. It never loads, defers or gates gtm.js.

The one-line install (the default since 2026-09-29): one synchronous script tag naming this site's script, with a fail-closed onerror. Same place as snippet, never async or defer.

Where the client artifacts are served from, for a Content-Security-Policy entry.

The site's compiled ruleset, which the payload fetches.

THE SAME SNIPPET, IN PIECES, for a caller with no HTML file to paste into -- a React root layout, a template helper, a framework plugin. Emit them in the order the order the snippet uses: config, bootstrap, blocker and Consent Mode line if present, TCF stub if present, payload last. The two inline pieces must run before anything else on the page and make no network request; the payload is async and must never block. Getting that wrong does not break the page -- it breaks the Consent Mode race the bootstrap exists to win, silently, on somebody else's visitors.

Empty since 2026-09-29: the site's config rides in the bootstrap's call. Emit it first if non-empty.

The inline bootstrap, its call carrying the site's config. Inline, first.

Present only when the site opts into Consent Mode extras. Inline, after the bootstrap.

Present only when the site blocks trackers outside Tag Manager. A SYNCHRONOUS script element with this src, integrity and crossorigin="anonymous", directly after the bootstrap -- never async, deferred or injected -- or hardcoded trackers run before consent. (Until 2026-09-29 this was blockerJs, an inline script.)

Always tag

False when something upstream of the paste is missing -- most often that no ruleset has been published yet. problems says which, in words meant for a developer.

True when siteTag runs EVENT MONITORING as soon as it is on the page, whatever ready says about the banner: the same one line serves both products, so a monitoring-only site installs exactly this line too (it shows no banner while the banner is offline or another consent tool runs the page, and monitors only where the visitor's consent allows).

What a strict Content-Security-Policy must allow for this install. Absent when ready is false. Merge each list into your own directive; nothing here replaces your policy.

Every origin our client loads from or sends to.

script-src for the one-line tag: the origins, 'unsafe-hashes' and the hash of its onerror handler. The hash is the same on every site. A nonce cannot cover the onerror attribute.

script-src for the inline snippet: the origins and one 'sha256-…' per inline script block. These hashes are this site's (its key is in the bootstrap's call) and change when the snippet does: re-read them after a banner or blocking change.

The ruleset, consent decisions and tag events.

The owner's logo on a paid Consent banner.

The banner puts a <style> element in its shadow root, so style-src needs 'unsafe-inline'.